Skip to content

Commit 2562910

Browse files
committed
C#: Update Csv validation to allow sources and sink kinds to be prefixed with generated.
1 parent d7bf024 commit 2562910

File tree

2 files changed

+14
-10
lines changed

2 files changed

+14
-10
lines changed

csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -358,20 +358,23 @@ module CsvValidation {
358358
)
359359
)
360360
or
361-
exists(string row, string kind | summaryModel(row) |
362-
kind = row.splitAt(";", 8) and
363-
not kind = ["taint", "value", "generated:taint", "generated:value"] and
361+
exists(string row, string k, string kind | summaryModel(row) |
362+
k = row.splitAt(";", 8) and
363+
getKind(k, kind, _) and
364+
not kind = ["taint", "value"] and
364365
msg = "Invalid kind \"" + kind + "\" in summary model."
365366
)
366367
or
367-
exists(string row, string kind | sinkModel(row) |
368-
kind = row.splitAt(";", 7) and
368+
exists(string row, string k, string kind | sinkModel(row) |
369+
k = row.splitAt(";", 7) and
370+
getKind(k, kind, _) and
369371
not kind = ["code", "sql", "xss", "remote", "html"] and
370372
msg = "Invalid kind \"" + kind + "\" in sink model."
371373
)
372374
or
373-
exists(string row, string kind | sourceModel(row) |
374-
kind = row.splitAt(";", 7) and
375+
exists(string row, string k, string kind | sourceModel(row) |
376+
k = row.splitAt(";", 7) and
377+
getKind(k, kind, _) and
375378
not kind = "local" and
376379
msg = "Invalid kind \"" + kind + "\" in source model."
377380
)

java/ql/lib/semmle/code/java/dataflow/ExternalFlow.qll

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -606,9 +606,10 @@ module CsvValidation {
606606
)
607607
)
608608
or
609-
exists(string row, string kind | summaryModel(row) |
610-
kind = row.splitAt(";", 8) and
611-
not kind = ["taint", "value", "generated:taint", "generated:value"] and
609+
exists(string row, string k, string kind | summaryModel(row) |
610+
k = row.splitAt(";", 8) and
611+
getKind(k, kind, _) and
612+
not kind = ["taint", "value"] and
612613
msg = "Invalid kind \"" + kind + "\" in summary model."
613614
)
614615
}

0 commit comments

Comments
 (0)